nesquena-hermes c1942a1cd8 fix(sessions): widen #3023 to all 5 session-id validators via shared is_safe_session_id helper ...

PR #3023 only updated Session.load() and Session.load_metadata_only(), leaving
three sibling validators (Session-internal _repair_stale_pending and the
/api/session/worktree/remove + /api/session/delete route handlers) still
gated on the old lowercase-only character set.  That would have shipped a
confusing UX where api-* and reachy-voice-* sessions could be loaded into
the sidebar but rejected with HTTP 400 on delete or worktree removal.

This commit factors the validation into a single is_safe_session_id helper
in api.models and updates all five call sites to use it.  Adds regression
coverage in tests/test_issue3023_safe_session_id_validators.py for both
the helper itself and a repo-wide guarantee that no narrow lowercase-only
magic string survives.

Closes the follow-up flagged by the parallel reviewer agent on #3023.

2026-05-28 02:09:05 +00:00

..

__init__.py

Hermes Web UI — Sprints 11-14: multi-provider models, settings, session QoL, alerts, polish

2026-03-31 07:02:47 +00:00

agent_health.py

fix(agent_health): detect profile-scoped gateway.pid for correct status

2026-05-25 10:35:37 +00:00

agent_sessions.py

fix: keep webui mirrored sessions out of cli filter

2026-05-28 00:51:12 +02:00

auth.py

Stage-batch14: add HERMES_WEBUI_PASSKEY feature flag for #2859 passkey support

2026-05-25 00:16:12 +00:00

background.py

feat(commands): /background, /btw slash commands + undo button + reasoning chip

2026-04-24 01:24:51 +00:00

clarify.py

chore: address review notes — dedup comment and 409-path clarification

2026-05-20 19:57:20 +00:00

commands.py

fix(security): drop unsafe-eval + add jsdelivr to CSP, sanitize plugin error

2026-05-11 17:53:02 +00:00

compression_anchor.py

fix(compression): ignore tool output for compaction cards

2026-05-25 11:27:15 +08:00

config.py

fix: cap custom models endpoint probes

2026-05-27 12:19:42 -04:00

dashboard_probe.py

fix: preserve IPv6 dashboard link brackets

2026-05-19 21:35:10 -04:00

extensions.py

Opus pre-release follow-ups for PR #1445

2026-05-02 03:49:40 +00:00

gateway_watcher.py

release: v0.50.241 (#1293)

2026-04-29 19:54:07 -07:00

goals.py

fix(i18n): localize /goal runtime status strings

2026-05-10 15:21:24 +08:00

helpers.py

fix: vendor math and yaml assets for CSP

2026-05-26 23:49:02 +02:00

kanban_bridge.py

perf(http): enable HTTP/1.1 keep-alive

2026-05-24 18:26:56 +00:00

metering.py

fix: show TPS in assistant message headers

2026-05-04 21:26:43 +00:00

models.py

fix(sessions): widen #3023 to all 5 session-id validators via shared is_safe_session_id helper

2026-05-28 02:09:05 +00:00

oauth.py

fix(oauth): serialize Anthropic env fallback reads

2026-05-07 02:47:19 +00:00

onboarding.py

Classify onboarding DNS probe failures consistently

2026-05-15 08:51:30 +08:00

passkeys.py

feat: support passkey-only auth

2026-05-25 00:14:38 +00:00

profiles.py

fix(windows): align WebUI defaults with Hermes Agent home path

2026-05-25 01:58:32 +00:00

providers.py

feat: sort configured/custom providers to top in model picker and settings

2026-05-22 16:13:46 +00:00

request_diagnostics.py

fix: add request wedge diagnostics

2026-05-08 15:37:08 +00:00

rollback.py

v0.50.255: Opus follow-ups (4 fixes) + CHANGELOG

2026-05-01 17:19:53 +00:00

routes.py

fix(sessions): widen #3023 to all 5 session-id validators via shared is_safe_session_id helper

2026-05-28 02:09:05 +00:00

run_journal.py

fix(chat): classify interrupted response causes

2026-05-25 02:06:42 +02:00

runtime_adapter.py

Stage 398: PR #2696 — feat(runtime): add runner-local adapter selection (RuntimeAdapter slice 4c, feature-flagged)

2026-05-21 17:43:54 +00:00

session_discoverability.py

feat: add session discoverability audit

2026-05-28 00:51:32 +02:00

session_events.py

sync session list from server events

2026-05-20 08:18:56 -06:00

session_lifecycle.py

fix: align WebUI memory commits with CLI boundaries

2026-05-17 05:04:57 -06:00

session_ops.py

fix(session): preserve sidecar truncation boundary

2026-05-25 21:21:15 +08:00

session_recovery.py

fix(session): rebuild missing startup index

2026-05-20 23:43:30 +08:00

skill_usage.py

fix: remove webui-side writer to avoid conflict with agent

2026-05-27 20:57:32 +08:00

startup.py

fix: P0 hotfixes — API regression, code block parser, chmod override

2026-05-01 12:10:48 +00:00

state_sync.py

Stage 406: PR #2827 — fix(state-sync): pass profile explicitly so background-thread DB writes hit the right state.db (#2762) by @Koraji95-coder

2026-05-24 18:57:40 +00:00

streaming.py

fix: remove webui-side writer to avoid conflict with agent

2026-05-27 20:57:32 +08:00

system_health.py

feat: add VPS resource health panel

2026-05-05 17:30:56 +00:00

terminal.py

fix(terminal): harden supervisor lifecycle and eliminate timeout race conditions

2026-05-25 20:45:17 +05:00

turn_journal.py

fix: lock turn journal appends

2026-05-15 16:39:45 -07:00

updates.py

Stage 403: Opus pre-release fixes (1 MUST-FIX + 3 SHOULD-FIX)

2026-05-24 17:42:06 +00:00

upload.py

fix duplicate chat upload filenames

2026-05-25 17:48:19 +00:00

usage.py

fix: display canonical cache hit percentage

2026-05-19 02:27:12 -06:00

workspace_git.py

fix(workspace): tighten git subprocess trust boundary

2026-05-20 11:02:45 +00:00

workspace.py

feat(workspace): add backend Git operations

2026-05-20 04:51:41 +00:00

worktrees.py

Harden worktree removal safeguards

2026-05-13 09:49:15 +08:00